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Introduction 


The Information Commissioner is producing a direct marketing code 
of practice, as required by the Data Protection Act 2018. A draft of 
the code is now out for public consultation. 


The draft code of practice aims to provide practical guidance and 
promote good practice in regard to processing for direct marketing 
purposes in compliance with data protection and e-privacy rules. 
The draft code takes a life-cycle approach to direct marketing. It 
starts with a section looking at the definition of direct marketing to 
help you decide if the code applies to you, before moving on to 
cover areas such as planning your marketing, collecting data, 
delivering your marketing messages and individuals rights. 


The public consultation on the draft code will remain open until 4 
March 2020.The Information Commissioner welcomes feedback on 
the specific questions set out below. 


You can email your response to directmarketingcode@ico.org.uk 


Or print and post to: 


Direct Marketing Code Consultation Team 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation, please 
email the Direct Marketing Code team. 


Privacy statement 


For this consultation we will publish all responses received from 
organisations except for those where the response indicates that 
they are an individual acting in a private capacity (eg a member of 
the public). All responses from organisations and individuals acting 
in a professional capacity (eg sole traders, academics etc) will be 
published but any personal data will be removed before publication 
(including email addresses and telephone numbers). 


For more information about what we do with personal data please 
see our privacy notice 


Q1 


Q2 


Q3 


Is the draft code clear and easy to understand? 


Yes, overall feedback received from Legal, Marketing, Data Science and 
Communications departments within Smart Pension indicate that the 
Code is relatively clear. 


If no please explain why and how we could improve this: 


Does the draft code contain the right level of detail? (When 
answering please remember that the code does not seek to 
duplicate all our existing data protection and e-privacy 
guidance) 


Although the Code is 123 pages long, the level of details appears 
appropriate and is written in plain clear language. 


If no please explain what changes or improvements you would 
like to see? 


Does the draft code cover the right issues about direct 
marketing? 


The Code is clearly rightly focused on direct marketing, but perhaps a 
distinction can be made between the processing activity in the context 
of direct marketing and the same processing activity where no direct 
marketing is involved. 


If no please outline what additional areas you would like to see 
covered: 


Regarding the section ‘Profiling and data enrichment’ 


Our Data Science team reviewed the Code with great interest and 

suggested that the ICO should produce perhaps separate guidance 
which is more applicable to professional data analysts. Indeed, the 
ICO could produce guidance specifically for data scientists. 


The data science team indicated that guidance on the aggregation 
of personal data from official or publicly available records would be 
very useful, even where such processing is performed only to 
acquire a deeper understanding of customer behaviour/interest for 
service purposes and where no direct marketing activity is 
undertaken. 


Q4 Does the draft code address the areas of data protection and e- 


privacy that are having an impact on your organisation’s direct 
marketing practices? 


Can we use data cleansing and tracing services? 


Yes, Regarding pages 61-64. In the course of service delivery, (not 
direct marketing) the guidance on data cleansing and tracing services 
provided confirming clarity to this organisation. Particularly in relation 
to keeping its database compliant when utilising tracing services by 
following the accuracy and data minimisation principles. 


What due diligence do we need to consider when using profiling 
or enrichment services? 


The guidance at page 63 regarding due diligence requirements provides 
pragmatic advice in order to ask third party service providers when on- 
boarding. This guidance will be useful in strengthening existing due 
diligence procedures. 


If no please outline what additional areas you would like to see 
covered 


Q5 Is it easy to find information in the draft code? 


Q6 


Q7 


Yes, the contents are clearly set out and particular topics/subjects are 
easy to find. 


If no, please provide your suggestions on how the structure 
could be improved: 


Do you have any examples of direct marketing in practice, good 
or bad, that you think it would be useful to include in the code: 


No 


If yes, please provide your direct marketing examples : 


Do you have any other suggestions for the direct marketing 


code? 


Checklists 
At the end of each section, we would suggest a summary ‘How To 
Get Things Right Checklist’ which would provide a step by step 


guide for organizations when managing particular elements of the 
Code. 


About you 
Q8 Are you answering as: 


e On behalf of an organization in the capacity of the Data Protection 
Officer. 


Please specify the name of your organisation: 
e Smart Pension Limited 

If other please specify: 

Q9 How did you find out about this survey? 


e ICO Website 


Thank you for taking the time to complete the survey 


